#!/bin/bash
#version 3
#date 20220225
#CentOS 7
#crontab: 0 9 * * 1 /usr/local/scripts/linuxcheck/Centos7/linuxcheck.sh >> /dev/null 2>&1

source /etc/profile

today=$(date +%Y%m%d)
homepath=$(cd `dirname $0`;pwd)
ipaddress=$(ip address | ag -o '(?<=inet )\d+\.\d+\.\d+\.\d+(?=\/2)' | head -n 1)
file_name=${ipaddress}'_'$HOSTNAME'.html'
file_output=${homepath}'/'${file_name}
file_md5=${homepath}/file_md5.txt
file_md5_log=${homepath}/file_md5.log

td_str=''
th_str=''
total_count='33'

create_html_css(){
  echo -e "<!DOCTYPE html>
<html>
<head>
<meta charset=utf-8>
<title>巡检详情</title>
<style>
	table {
		width: 100%;
		font-size: 14px;
	}
	table > thead > tr > th,
	table > tbody > tr > th,
	table > tfoot > tr > th,
	table > thead > tr > td,
	table > tbody > tr > td,
	table > tfoot > tr > td {
	  padding: 8px;
	  line-height: 1.42857143;
	  border: 1px solid #EAECEE;
	  word-break: break-all;
	  word-break:break-word;
	}
	table thead {
	  background-color: #f8f9fa;
	  text-align: left;
	}
	#hname{
	  background: linear-gradient(#ecf8ff, #fff);
	  border-radius: 4px;
	}
	#hname h1 {
	  text-align: center;
	  color: #1180fb;
	  font-weight: bold;
	  font-size: 40px;
      padding: 20px;
	  letter-spacing: -.045em;
/*	  border-bottom: 1px solid #ecf8ff;*/
	}
	#tname h3 {
	  padding: 12px 16px;
	  background-color: #ecf8ff;
	  border-radius: 4px;
	  border-left: 5px solid #50bfff;
	  margin: 40px 0 20px;
	  font-size: 20px;
	  line-height: 30px;
	  color: #333;
	}
</style>
</head>
<body>
	<div id=maxname style=width:1000px;margin:auto>
      <div id=hname style=height:90px>
        <h1>服务器巡检详情</h1>
      </div>
      <div id=content style=width:1000px;float:left;>"
}
create_html_head(){
  echo -e "<div id=content style=width:1000px;float:left;><div id=tname><h3>$1</h3></div>"
}

create_html_head1(){
echo -e "<h4>$1</h4>"
}

create_html_head2(){
echo -e "<h5>$1</h5>"
}

create_table_head1(){
  echo -e "<table width=65% border=1 bordercolor=#000000 cellspacing=0px style=border-collapse:collapse>"
}
create_table_head2(){
  echo -e "<table width=10% border=1 bordercolor=#000000 cellspacing=0px style=border-collapse:collapse>"
}
create_td(){
    td_str=`echo $1 | awk 'BEGIN{FS="|"}''{i=1; while(i<=NF) {print "<td>"$i"</td>";i++}}'`
}
create_th(){
    th_str=`echo $1|awk 'BEGIN{FS="|"}''{i=1; while(i<=NF) {print "<th>"$i"</th>";i++}}'`
}
create_tr1(){
  create_td "$1"
  echo -e "<tr>
    $td_str
  </tr>" >> $file_output
}
create_tr2(){
  create_th "$1"
  echo -e "<thead><tr>
    $th_str
  </tr></thead>" >> $file_output
}
create_tr3(){
  echo -e "<tr><td>
  <pre style=\"font-family:Courier New; word-wrap: break-word; white-space: pre-wrap; white-space: -moz-pre-wrap\">
`cat $1`
  </pre></td></tr>" >> $file_output
}
create_table_end(){
  echo -e "</table>"
}
create_html_end(){
  echo -e "<div> <br> </div>
      <div id=bool style=background-color:#F0F8FF;clear:both;text-align:center;>
        部门：互联网部运行维护部维护操作中心
      </div>
  </div>
</body>
</html>
"
}



NAME_VAL_LEN=12

name_val () {
   printf "%+*s | %s\n" "${NAME_VAL_LEN}" "$1" "$2"
}

init_file(){
    if [ ! -e ${file_md5} ];then
      touch ${file_md5}
    fi   
   
   md5sum -c ${file_md5} |ag -v 'OK' > /tmp/tmpinfo_file.txt
}

init_info(){
   printf "%+*s | %s | %s \n" "${NAME_VAL_LEN}" "序号" "异常巡检项" "状态" > /tmp/tmpinfo_abnormal_t_${today}.txt
   touch /tmp/tmpinfo_abnormal_h_${today}.txt
}

abnormal_info () {
   line=$(awk 'END{print NR+1}' /tmp/tmpinfo_abnormal_h_${today}.txt)
   printf "%+*s | %s | %s \n" "${NAME_VAL_LEN}" "$line" "$1" "$2" >> /tmp/tmpinfo_abnormal_h_${today}.txt
}

check_info(){
  if [ ! -s '/tmp/tmpinfo_abnormal_h_${today}.txt' ];then
    echo "1|无|无" > /tmp/tmpinfo_abnormal_h_${today}.txt
  fi
}

get_info_count(){
    printf "%+*s | %s | %s \n" "${NAME_VAL_LEN}" "检测项总数" "通过项" "未通过项" > /tmp/tmpinfo_count_t_${today}.txt
    if [ ! -e '/tmp/tmpinfo_count_h_${today}.txt' ];then
      touch /tmp/tmpinfo_count_h_${today}.txt
    fi
   
    count=`awk 'END{print NR}' /tmp/tmpinfo_abnormal_h_${today}.txt`
    let normal_count=$total_count-$count
    printf "%+*s | %s | %s \n" "${NAME_VAL_LEN}" $total_count  $normal_count $count > /tmp/tmpinfo_count_h_${today}.txt
}

get_summary(){
    system=$(uname)
    count=$(cat /tmp/tmpinfo_count_h_${today}.txt|awk -F'|' '{print $3}')
    printf "summary|%s|%s|%s|%s|%s" $file_name $ipaddress $HOSTNAME $count $system > /tmp/tmpinfo_summary_${today}.txt
}

#系统信息
get_physics(){
    name_val "巡检时间" "`date`"
    name_val "主机名" "`uname -n`"
    name_val "系统版本" "`cat /etc/{oracle,redhat,SuSE,centos}-release 2>/dev/null|sort -ru|head -n1`"
    name_val "内核版本" "`uname -r`"
    name_val "架构" "CPU=`lscpu|ag Architecture|awk -F: '{print $2}'|sed 's/^[[:space:]]*//g'`;OS=`getconf LONG_BIT`-bit"
}

#CUP信息
get_cpuinfo () {
   file="/proc/cpuinfo"
   virtual=`cat ${file} | grep -c ^processor`
   physical=`cat ${file} | ag 'physical id' | sort -u | wc -l`
   cores=`cat ${file} | ag 'cpu cores' | head -n 1 | cut -d: -f2`
   model=`cat ${file} | ag "model name" | sort -u|awk -F: '{print $2}'`
   SysCPUUsed=`vmstat | sed -n '$ p' | awk '{print 100-$15}'`
   [ "${physical}" = "0" ] && physical="${virtual}"
   [ -z "${cores}" ] && cores=0
   cores=$((${cores} * ${physical}));
   htt=""
   if [ ${cores} -gt 0 -a $cores -lt $virtual ]; then htt=yes; else htt=no; fi
   #异常判断
   if [ ${SysCPUUsed} -gt 50 ]; then abnormal_info "cpu使用率" "高负载"; fi
   
   name_val "cpu型号" "${model}"
   name_val "线程" "physical = ${physical}, cores = ${cores}, virtual = ${virtual}, hyperthreading = ${htt}"
   name_val "cpu使用率(%)" "${SysCPUUsed}%"
}

#CPU消耗
get_cputop(){
   ps aux|head -1 > /tmp/tmpinfo_cput_${today}.txt
   ps aux|ag -v PID|sort -rn -k +3|head  >> /tmp/tmpinfo_cput_${today}.txt
}

#内存情况
get_meminfo(){
   free -glht >>/tmp/tmpinfo_mem1_${today}.txt
   memtotal=`vmstat -s | head -1 | awk '{print $1}'`
   avm=`vmstat -s| sed -n '3p' | awk '{print $1}'`
   let memused=100*${avm}/${memtotal}
   #异常判断
   if [ ${memused} -gt 80 ]; then abnormal_info "内存使用率" "高负载"; fi
   name_val "内存使用率(%)" "${memused}%" >> /tmp/tmpinfo_mem2_${today}.txt  
}

#内存消耗
get_memtop(){
   ps aux|head -1 > /tmp/tmpinfo_memt_${today}.txt
   ps aux|ag -v PID|sort -rn -k +4|head  >> /tmp/tmpinfo_memt_${today}.txt
}

#磁盘信息
get_diskinfo(){
   echo "Filesystem        |Type   |Size |  Used  | Avail | Use%  | Mounted on | Opts" > /tmp/tmpinfo_disk_t_${today}.txt
   df -ThP|ag -v tmpfs|sed '1d'|sort > /tmp/tmpinfo_df1_${today}.txt
   mount -l|awk '{print $1,$6}'|ag ^/|sort > /tmp/tmpinfo_df2_${today}.txt
   join /tmp/tmpinfo_df1_${today}.txt /tmp/tmpinfo_df2_${today}.txt\
   |awk '{print $1,"|", $2,"|", $3,"|", $4,"|", $5,"|", $6,"|", $7,"|", $8}' >> /tmp/tmpinfo_disk_h_${today}.txt 
   lsblk >>/tmp/tmpinfo_disk_blk_${today}.txt 
   iostat -k -d 5 3  >> /tmp/tmpinfo_disk_io_${today}.txt
   
   #异常判断
   ab_value=0
   cat /tmp/tmpinfo_disk_h_${today}.txt | awk '{print $11}'| awk -F'%' '{print $1}' > /tmp/tmpinfo_disk_use_${today}.txt 
   while read line   
   do
     if [ ${line} -gt 1 ];then
       ab_value=1
     fi
   done < /tmp/tmpinfo_disk_use_${today}.txt
   if [ ${ab_value} -gt 80 ];then abnormal_info "磁盘使用率" "高负载";fi        
}

#IP信息
get_netinfo(){
   echo "interface | status | ipadds     |      mtu    |  Speed     |     Duplex" >> /tmp/tmpinfo_netip_t_${today}.txt
   for ipstr in `ifconfig -a|ag ": flags"|awk  '{print $1}'|sed 's/.$//'`
   do
      ipadds=`ifconfig ${ipstr}|ag -w inet|awk '{print $2}'`
      mtu=`ifconfig ${ipstr}|ag mtu|awk '{print $NF}'`
      speed=`ethtool ${ipstr}|ag Speed|awk -F: '{print $2}'`
      duplex=`ethtool ${ipstr}|ag Duplex|awk -F: '{print $2}'`
      echo "${ipstr}"  "up" "${ipadds}" "${mtu}" "${speed}" "${duplex}"\
      |awk '{print $1,"|", $2,"|", $3,"|", $4,"|", $5,"|", $6}'  >> /tmp/tmpinfo_netip_h_${today}.txt
   done
}

#收/发信息
get_netbyte(){
  echo "Interface|ByteRec|PackRec|ByteTran|PackTran"  >> /tmp/tmpinfo_netbyte_t_${today}.txt
  awk ' NR>2' /proc/net/dev | while read line; do
    echo "$line" | awk -F ':' '{print "  "$1"  " $2}' |
      awk '{print $1"|"$2"|"$3"|"$10"|"$11}' >> /tmp/tmpinfo_netbyte_h_${today}.txt
  done
}
#端口信息
get_netport(){
  echo "Proto|Recv-Q|Send-Q|Local Address|Foreign Address|State|User|Inode|PID/Program name" >> /tmp/tmpinfo_netport_t_${today}.txt
  netstat -tplen | awk '{if(NR>2){print}}' | while read line;do 
    echo ${line} | awk '{print $1"|"$2"|"$3"|"$4"|"$5"|"$6"|"$7"|"$8"|"$9}' >> /tmp/tmpinfo_netport_h_${today}.txt
  done
  netstat -uplen | awk '{if(NR>2){print}}'| while read line;do 
    echo ${line} | awk '{print $1"|"$2"|"$3"|"$4"|"$5"|-|"$6"|"$7"|"$8}' >> /tmp/tmpinfo_netport_h_${today}.txt
  done
}
#TCP连接信息
get_nettcp(){
  netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a,"|",S[a]}' > /tmp/tmpinfo_netcon_${today}.txt
}

#路由信息
get_netroute(){
  /sbin/route -ne > /tmp/tmpinfo_netroute.txt

}

#DNS信息
get_netdns(){
  ag -o '\d+\.\d+\.\d+\.\d+' </etc/resolv.conf > /tmp/tmpinfo_netdns.txt

}

#防火墙信息
get_netiptables(){
  /usr/sbin/iptables -L > /tmp/tmpinfo_netiptables.txt
  
}

#获取计划任务
get_cron(){
  for filename in `ls /var/spool/cron/`
  do 
    cd /var/spool/cron/
    echo "--------用户:"${filename}"--------" >> /tmp/tmpinfo_cron_user.txt
    cat $filename >> /tmp/tmpinfo_cron_user.txt
  done
  cd ${homepath}

  ls -alht /etc/cron.*/* >> /tmp/tmpinfo_cron_sys.txt
}
#检查计划任务中异常命令
get_cron_ab(){
  ag '((?:useradd|groupadd|chattr)|(?:wget\s|curl\s|tftp\s\-i|scp\s|sftp\s)|(?:bash\s\-i|fsockopen|nc\s\-e|sh\s\-i|\"/bin/sh\"|\"/bin/bash\"))' /etc/cron* /var/spool/cron/* > /tmp/tmpinfo_cron_ab.txt
  if [ ! -s '/tmp/tmpinfo_cron_ab.txt' ];then
    echo "无" > /tmp/tmpinfo_cron_ab.txt
  else
    abnormal_info "可疑计划" "存在异常"
  fi
}

#环境变量
get_env(){
  printf "%+*s | %s | %s \n" "${NAME_VAL_LEN}" "序号" "变量" "值" > /tmp/tmpinfo_env_t.txt
  env | awk -F'=' '{print NR"|"$1"|"$2}' | grep -Ev "LS_COLORS|LESSOPEN|XDG_SESSION_ID|SHLVL|SSH_CIENT|SSH_CONNECTION|SSH_TTY|TERM" > /tmp/tmpinfo_env_h.txt  
}

#用户信息
get_user(){
  #可登录用户
  cat /etc/passwd | ag -v 'nologin$|false$' > /tmp/tmpinfo_user_passwd.txt
  #sudo信息
  cat /etc/sudoers | ag -v '#' | sed -e '/^$/d' > /tmp/tmpinfo_user_sudo.txt
  #用户登陆记录
  last > /tmp/tmpinfo_user_last_${today}.txt
  #用户最后登陆记录
  #printf "%+*s | %s | %s | %s | %s\n" "${NAME_VAL_LEN}" "序号" "Username" "Port" "From" "Latest"> /tmp/tmpinfo_user_lastlog_t_${today}.txt
  #lastlog | awk '{if(NR>1){printf("%s|%s|%s|%s|%s %s %s %s %s %s\n",NR-1,$1,$2,$3,$4,$5,$6,$7,$8,$9)}}' > /tmp/tmpinfo_user_lastlog_h_${today}.txt
  lastlog > /tmp/tmpinfo_user_lastlog_${today}.txt
  #统计登陆IP
  ag -a accepted /var/log/secure /var/log/auth.* 2>/dev/null | ag -o '\d+\.\d+\.\d+\.\d+' | sort | uniq > /tmp/tmpinfo_user_ip_${today}.txt
}

#服务信息
get_service() {
  #运行的服务
  systemctl -l | ag running | awk '{print $1}' > /tmp/tmpinfo_service_run_${today}.txt
 
  #最近添加的服务
  ls -alhtR /etc/systemd/system/multi-user.target.wants > /tmp/tmpinfo_service_new_${today}.txt
  ls -alht /etc/systemd/system/*.service | ag -v 'dbus-org' > /tmp/tmpinfo_service_new_${today}.txt
  if [ ! -s '/tmp/tmpinfo_service_new_${today}.txt' ];then
    echo "无" > /tmp/tmpinfo_service_new_${today}.txt
  fi
}

#bash信息
get_bash(){
  #操作命令审查
  cat ~/.*history | ag '(?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])|http://|https://|\bssh\b|\bscp\b|\.tar|\bwget\b|\bcurl\b|\bnc\b|\btelnet\b|\bbash\b|\bsh\b|\bchmod\b|\bchown\b|/etc/passwd|/etc/shadow|/etc/hosts|\bnmap\b|\bfrp\b|\bnfs\b|\bsshd\b|\bmodprobe\b|\blsmod\b|\bsudo\b' --nocolor | ag -v 'man\b|ag\b|cat\b|sed\b|git\b|docker\b|rm\b|touch\b|mv\b|\bapt\b|\bapt-get\b' > /tmp/tmpinfo_bash_history_${today}.txt
  
  #bashrc文件
  cat ~/.bashrc | ag -v '#' > /tmp/tmpinfo_bash_bashrc.txt

  #反弹shell
  ps -ef | ag 'bash -i' | ag -v 'ag' | awk '{print $2}' | xargs -i{} lsof -p {} | ag 'ESTAB'  > /tmp/tmpinfo_bash_shell_${today}.txt
  if [ ! -s '/tmp/tmpinfo_bash_shell_${today}.txt' ];then
    echo "无" > /tmp/tmpinfo_bash_shell_${today}.txt
  else
    abnormal_info "反弹shell" "存在异常"
  fi
}

get_file(){
  #tmp目录
  ls /tmp /var/tmp /dev/shm -alht | ag -v 'tmpinfo'> /tmp/tmpinfo_tmp__${today}.txt
  #近7天文件内容改动
  find /etc /bin /lib /sbin /dev /root/ /home /tmp /var /usr ! -path "/var/log*" ! -path "/var/spool/exim4*" ! -path "/var/backups*" -mtime -7 -type f | ag -v '\.log|cache|vim|/share/|/lib/|.zsh|.gem|\.git|LICENSE|README|/_\w+\.\w+|\blogs\b|elasticsearch|nohup|i18n|tmpinfo' | xargs -i{} ls -alh {} > /tmp/tmpinfo_7mtime_${today}.txt
  #近7天文件元数据改动
  find /etc /bin /lib /sbin /dev /root/ /home /tmp /var /usr ! -path "/var/log*" ! -path "/var/spool/exim4*" ! -path "/var/backups*" -ctime -7 -type f | ag -v '\.log|cache|vim|/share/|/lib/|.zsh|.gem|\.git|LICENSE|README|/_\w+\.\w+|\blogs\b|elasticsearch|nohup|i18n|tmpinfo' | xargs -i{} ls -alh {} > /tmp/tmpinfo_7ctime_${today}.txt
  #大文件200mb
  find / ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/boot/*" -size +200M -exec ls -alht {} + 2>/dev/null | ag '\.gif|\.jpeg|\.jpg|\.png|\.zip|\.tar.gz|\.tgz|\.7z|\.log|\.xz|\.rar|\.bak|\.old|\.sql|\.1|\.txt|\.tar|\.db|/\w+$' --nocolor | ag -v 'ib_logfile|ibd|mysql-bin|mysql-slow|ibdata1' > /tmp/tmpinfo_bigfile_${today}.txt
  if [ ! -s '/tmp/tmpinfo_bigfile_${today}.txt' ];then
    echo "无" > /tmp/tmpinfo_bigfile_${today}.txt
  fi
}

get_ssh(){
  #暴力破解
  if true;then
    ag -a 'authentication failure' /var/log/secure* | awk '{print $14}' | awk -F '=' '{print $2}' | ag '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -nr | head -n 25 > /tmp/tmpinfo_ssh_${today}.txt
  else
    ag -a 'authentication failure' /var/log/auth.* | awk '{print $14}' | awk -F '=' '{print $2}' | ag '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -nr | head -n 25 >> /tmp/tmpinfo_ssh_${today}.txt
  fi
  if [ ! -s '/tmp/tmpinfo_ssh_${today}.txt' ];then
    echo "无" > /tmp/tmpinfo_ssh_${today}.txt
  else
    abnormal_info "暴力破解" "存在异常"
  fi
  #SSHD
  stat /usr/sbin/sshd | ag 'Access|Modify|Change' --nocolor > /tmp/tmpinfo_sshd_${today}.txt

  #ssh后门配置检查
  if [ -e "$HOME/.ssh/config" ]; then
    ag LocalCommand <~/.ssh/config > /tmp/tmpinfo_ssh_config_${today}.txt
    ag ProxyCommand <~/.ssh/config >> /tmp/tmpinfo_ssh_config_${today}.txt
  else
    echo -e "未发现ssh后门文件" > /tmp/tmpinfo_ssh_config_${today}.txt
  fi
  
}

get_initmd5(){
   #需校验的文件初始化md5值
   if [ ! -e ${file_md5} ];then
      touch ${file_md5}

		  md5sum /tmp/tmpinfo_netroute.txt >> ${file_md5}
		  md5sum /tmp/tmpinfo_netdns.txt >> ${file_md5}
		  md5sum /tmp/tmpinfo_netiptables.txt >> ${file_md5}
		  md5sum /tmp/tmpinfo_cron_user.txt >> ${file_md5}
		  # md5sum /tmp/tmpinfo_env_h.txt >> ${file_md5}
		  
		  cmdline=(
		    "/sbin/ifconfig"
		    "/bin/ls"
		    "/bin/login"
		    "/bin/netstat"
		    "/bin/top"
		    "/bin/ps"
		    "/bin/find"
		    "/bin/grep"
		    "/usr/bin/curl"
		    "/usr/bin/wget"
		    "/etc/passwd"
		    "/etc/shadow"
		    "/etc/profile"
		    "/etc/hosts"
		  )
		  for soft in "${cmdline[@]}"; do
		    md5sum ${soft} >> ${file_md5}
		  done  
   fi
}

get_md5(){
  #检查关键文件及命令是否被篡改
  md5sum -c ${file_md5} > ${file_md5_log} 2>&1
  file=$(cat ${file_md5_log} |ag 'FAILED' |awk -F':' '{print $1}')
  for name in ${file}
  do
    case $name in
      "/tmp/tmpinfo_netroute.txt")
        abnormal_info "路由信息" "被修改"
        ;;
      "/tmp/tmpinfo_netdns.txt")
        abnormal_info "DNS信息" "被修改"
        ;;
      "/tmp/tmpinfo_netiptables.txt")
        abnormal_info "防火墙信息" "被修改"
        ;;       
      "/tmp/tmpinfo_cron_user.txt")
        abnormal_info "用户计划" "被修改"
        ;;      
      "/tmp/tmpinfo_env_h.txt")
        abnormal_info "环境变量" "被修改"
        ;;       
      *)
        abnormal_info "关键文件" "被修改"
        ;;        
    esac        
  done
}





#生成统计数据
create_data () {
  init_info
  get_physics >> /tmp/tmpinfo_physics_${today}.txt
  get_cpuinfo >> /tmp/tmpinfo_cpu_${today}.txt
  get_cputop
  get_meminfo
  get_memtop
  get_diskinfo
  get_netinfo
  get_netbyte
  get_netport
  get_nettcp
  get_netroute
  get_netdns
  get_netiptables
  get_cron
  get_cron_ab
  get_env
  get_user
  get_service
  get_bash
  get_file
  get_ssh
  get_initmd5
  get_md5
  
  get_info_count
  #check_info
  get_summary
}

#生成网页
create_html(){
  rm -rf $file_output
  touch $file_output
  create_html_css >> $file_output
  
  create_html_head "巡检信息概览" >> $file_output  
  create_table_head1 >> $file_output      
  
       
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_count_t_${today}.txt  
  while read line
  do
    create_tr1 "$line" 
  done  < /tmp/tmpinfo_count_h_${today}.txt
  create_table_end >> $file_output
  
  echo -e "<div> <br> </div>" >> $file_output
  
  create_table_head1 >> $file_output 
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_abnormal_t_${today}.txt  
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_abnormal_h_${today}.txt  
  create_table_end >> $file_output

  
  create_html_head "系统信息" >> $file_output
  create_html_head1 "1.基础信息" >> $file_output
  create_table_head1 >> $file_output
  
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_physics_${today}.txt
  create_table_end >> $file_output


  create_html_head "CPU信息" >> $file_output
  create_html_head1 "1.基础信息" >> $file_output
  create_table_head1 >> $file_output

  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_cpu_${today}.txt  
  create_table_end >> $file_output

  create_html_head1 "2.消耗TOP10" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_cput_${today}.txt"
  create_table_end >> $file_output

  create_html_head "内存信息" >> $file_output
  create_html_head1 "1.基础信息" >> $file_output
  create_table_head1 >> $file_output
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_mem2_${today}.txt
  create_table_end >> $file_output
  
  echo -e "<div> <br> </div>" >> $file_output
  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_mem1_${today}.txt"
  create_table_end >> $file_output
  
  create_html_head1 "2.消耗TOP10" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_memt_${today}.txt"
  create_table_end >> $file_output
  
  create_html_head "磁盘信息" >> $file_output
  create_html_head1 "1.基础信息" >> $file_output  
  create_table_head1 >> $file_output
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_disk_t_${today}.txt
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_disk_h_${today}.txt 
  create_table_end >> $file_output  
  
  create_html_head1 "2.块设备" >> $file_output 
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_disk_blk_${today}.txt"
  create_table_end >> $file_output
  
  create_html_head1 "3.磁盘IO" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_disk_io_${today}.txt"
  create_table_end >> $file_output
  
  create_html_head "网络信息" >> $file_output  
  create_html_head1 "1.IP信息" >> $file_output
  create_table_head1 >> $file_output
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_netip_t_${today}.txt
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_netip_h_${today}.txt
  create_table_end >> $file_output
  
  create_html_head1 "2.收/发包信息" >> $file_output
  create_table_head1 >> $file_output
  
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_netbyte_t_${today}.txt
  
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_netbyte_h_${today}.txt   
  create_table_end >> $file_output
  
  create_html_head1 "3.端口信息" >> $file_output
  create_table_head1 >> $file_output
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_netport_t_${today}.txt
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_netport_h_${today}.txt
  create_table_end >> $file_output

  create_html_head1 "4.TCP连接信息" >> $file_output
  create_table_head1 >> $file_output  
    while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_netcon_${today}.txt
  create_table_end >> $file_output
  
  create_html_head1 "5.路由信息" >> $file_output
  create_table_head2 >> $file_output  
  create_tr3 "/tmp/tmpinfo_netroute.txt"
  create_table_end >> $file_output  
  
  create_html_head1 "6.DNS信息" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_netdns.txt" 
  create_table_end >> $file_output   
  
  create_html_head1 "7.防火墙信息" >> $file_output
  create_table_head2 >> $file_output  
  create_tr3 "/tmp/tmpinfo_netiptables.txt"
  create_table_end >> $file_output  
  
  
  create_html_head "计划任务" >> $file_output  
  create_html_head1 "1.用户计划" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_cron_user.txt"
  create_table_end >> $file_output  
  
  create_html_head1 "2.系统计划" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_cron_sys.txt"
  create_table_end >> $file_output  
  
  create_html_head1 "3.可疑计划" >> $file_output
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_cron_ab.txt"
  create_table_end >> $file_output    
  create_html_head2 "排查是否存在以下命令：useradd|groupadd|chattr|wget|curl|tftp|scp|sftp|bash -i|fsockopen|nc -e|sh -i" >>$file_output
    
  create_html_head "环境变量" >> $file_output 
  create_html_head1 "1.基础信息" >> $file_output  
  create_table_head1 >> $file_output
  while read line
  do
    create_tr2 "$line" 
  done < /tmp/tmpinfo_env_t.txt
  while read line
  do
    create_tr1 "$line" 
  done < /tmp/tmpinfo_env_h.txt 
  create_table_end >> $file_output  
  
  create_html_head "用户信息" >> $file_output 
  create_html_head1 "1.可登陆用户" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_user_passwd.txt"
  create_table_end >> $file_output   
  
  create_html_head1 "2.sudo信息" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_user_sudo.txt"
  create_table_end >> $file_output    
      
  create_html_head1 "3.用户登陆记录" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_user_lastlog_${today}.txt"
  create_table_end >> $file_output     
  
  create_html_head1 "4.用户登陆详情" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_user_last_${today}.txt"
  create_table_end >> $file_output     

  create_html_head1 "5.登陆IP统计" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_user_ip_${today}.txt"
  create_table_end >> $file_output     

  create_html_head "服务信息" >> $file_output 
  create_html_head1 "1.正运行的服务" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_service_run_${today}.txt"
  create_table_end >> $file_output   

  create_html_head1 "2.最近添加的服务" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_service_new_${today}.txt"
  create_table_end >> $file_output  

  create_html_head "Bash信息" >> $file_output 
  create_html_head1 "1.命令审查" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_bash_history_${today}.txt"
  create_table_end >> $file_output   

  create_html_head1 "2.bashrc信息" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_bash_bashrc.txt"
  create_table_end >> $file_output  

  create_html_head1 "3.反弹Shell" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_bash_shell_${today}.txt"
  create_table_end >> $file_output  

  create_html_head "文件信息" >> $file_output 
  create_html_head1 "1.TMP目录" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_tmp__${today}.txt"
  create_table_end >> $file_output     
  

  create_html_head1 "2.近7天文件内容改动" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_7mtime_${today}.txt"
  create_table_end >> $file_output    
  
  create_html_head1 "3.近7天文件元数据改动" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_7ctime_${today}.txt"
  create_table_end >> $file_output    
  
  create_html_head1 "4.大于200M文件" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_bigfile_${today}.txt"
  create_table_end >> $file_output   
  
  create_html_head1 "5.关键文件" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 ${file_md5_log}
  create_table_end >> $file_output  
  
  create_html_head "SSH信息" >> $file_output 
  create_html_head1 "1.暴力破解" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_ssh_${today}.txt"
  create_table_end >> $file_output       
  
  create_html_head1 "2.sshd信息" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_sshd_${today}.txt"
  create_table_end >> $file_output   
  
  create_html_head1 "2.ssh配置检查" >> $file_output  
  create_table_head2 >> $file_output
  create_tr3 "/tmp/tmpinfo_ssh_config_${today}.txt"
  create_table_end >> $file_output     
      
  
  create_html_end >> $file_output
  
  echo "<!--"  >> $file_output
  cat /tmp/tmpinfo_summary_${today}.txt  >> $file_output
  echo " " >> $file_output
  echo "-->" >> $file_output
}

#生成数据以及报告
create_data
create_html

#报告存档
path_bak=${homepath}'/'$(date +%Y)'/'$(date +%Y%m)
/bin/mkdir -p ${path_bak}
/bin/cp -pf ${file_output} ${path_bak}'/'${ipaddress}'_'$HOSTNAME'_'${today}'.html'

#删除临时文件
rm -rf /tmp/tmp*
rm -rf ./file_md5.log
